Malicious PDF — malware analysis report

Static analysis result for SHA-256 d13a3bae8dba5819…

MALICIOUS

PDF

66.2 KB Created: 2020-03-07 20:00:53 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: f1f9c047845e5184603f9c05e7e6bf46 SHA-1: 81963f8b8f39fca10377127ccc775b9360fbe1f0 SHA-256: d13a3bae8dba5819d4a20c3e805e88d5a76989a49708c1780a09f17e390e5768
84 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1566.002 Phishing: Spearphishing Attachment

The PDF document employs a lure by presenting itself as a 'Pinyin converter tone mark' tool, instructing the user to enable macros or editing to view its content. This is a common technique to bypass security measures. The document contains a large farm of external links, primarily pointing to other PDF files hosted on various domains, suggesting a link-based distribution or redirection strategy. No scripts were extracted, limiting further analysis of direct payload execution.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://8uxk6.slpny.com/uploads/1/3/0/6/130622049/130622049.html#pinyin+converter+tone+mark
    • http://mail.judithavers.com/uploads/1/3/0/3/130379060/zowubibu_bewojeza_benegopuduzize.pdf
    • http://dominicbercier.com/uploads/1/3/0/4/130483256/sajupoxejok.pdf
    • http://charltonelectricalservices.com/uploads/1/3/0/6/130605270/levanol.pdf
    • http://gruporetolatino.com/uploads/1/3/0/7/130776162/xixetedelib.pdf
    • http://twopeaspodcasts.com/uploads/1/3/0/5/130551775/920938.pdf
    • http://vanessagallas.com/uploads/1/3/0/6/130620752/f8958.pdf
    • http://oginnovate.com/uploads/1/3/0/6/130621901/8b261016.pdf
    • http://enhancedbenefits.us/uploads/1/3/0/4/130488328/kulifix-fupurovepibore-sazix-dapufirejonuv.pdf
    • http://opiniononline.net/uploads/1/3/0/5/130541188/a0c53680a31eb9.pdf
    • http://cinemillion.com/uploads/1/3/0/7/130775274/zavobamuzezuf.pdf
    • http://nutricionbasadaentrofologia.com/uploads/1/3/0/5/130551187/lupitipilovotevobuz.pdf
    • http://retrotri.com/uploads/1/3/0/5/130545484/toguniboganuxumudu.pdf
    • http://www.arabellabreckenridge.com/uploads/1/3/0/7/130739938/5515814.pdf
    • http://sookeyhairextensions.com/uploads/1/3/0/7/130739924/12fca6.pdf
    • http://rbfengenharia.net/uploads/1/3/0/2/130272978/b168e44.pdf
    • http://mnixonsclassroom.com/uploads/1/3/0/4/130488244/rikojom.pdf
    • http://agealive.net/uploads/1/3/0/6/130639054/nodukigutesaxaxomi.pdf
    • http://acadiantax.com/uploads/1/3/0/5/130540159/muxalu.pdf
    • http://cauler.com/uploads/1/3/0/6/130620949/fde24c67fe886d.pdf
    • http://paravettemedics.com/uploads/1/3/0/3/130323794/e57298118e.pdf
    • http://jso.tn.org/uploads/1/3/0/2/130273962/zubaditubomizos.pdf
    • http://mannasweety.com/uploads/1/3/0/6/130639233/bunezemunakuniv.pdf
    • http://tripledogdare.com/uploads/1/3/0/4/130476068/lupuboz.pdf
    • http://scwaterfrontworks.com/uploads/1/3/0/7/130776889/2285137.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c230.bin
cba3a74a30f0f470b6660f5b6e37b204e0a1813300649b6719e2caa3b4ad11df		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC230 8976 bytes
font_01_sfnt_off0000e441.bin
d2e966f4d26ec9d24db06929a1fba514b399dd43486d20d0ff389cf2ad0d20c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE441 6888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.